Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe
-
Size
2.2MB
-
MD5
9da654485f8786dc53cf526d62046927
-
SHA1
bc94a71f75a70119c80acb589846b5c2316e5f5a
-
SHA256
cba9ddc34c961e6452af5ca61d997a829de49b545144df536c7e6b00073a4411
-
SHA512
97c803a35f920ce123ca3547abe3afffb7ef3c576c05fcc72f3134148170877a5a8dee695024a5b7700e0fd0d7178ca6d68fcf78fde44d763542385305544bd8
-
SSDEEP
24576:oOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58k6J17W8CX32+KJNA80T:oOOh3aN4kuLbegmtGgcW+S8
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4016 alg.exe 4932 DiagnosticsHub.StandardCollector.Service.exe 868 elevation_service.exe 3164 fxssvc.exe 3596 elevation_service.exe 4800 maintenanceservice.exe 924 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a604b5f8293b476c.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4932 DiagnosticsHub.StandardCollector.Service.exe 4932 DiagnosticsHub.StandardCollector.Service.exe 4932 DiagnosticsHub.StandardCollector.Service.exe 4932 DiagnosticsHub.StandardCollector.Service.exe 4932 DiagnosticsHub.StandardCollector.Service.exe 4932 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 60 2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe Token: SeAuditPrivilege 3164 fxssvc.exe Token: SeDebugPrivilege 4016 alg.exe Token: SeDebugPrivilege 4016 alg.exe Token: SeDebugPrivilege 4016 alg.exe Token: SeDebugPrivilege 4932 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_9da654485f8786dc53cf526d62046927_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:60
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2204
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:868
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3596
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4800
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5bd814608c0fe35f0c6f27eee29239b77
SHA12f3d33c2187aad4f51bedeebcc7dc42d60a3e879
SHA25681e758e67f09f4daf116c46355ee52ee160604c771842fec72cb56a8bb5684fc
SHA512140178427371a603e70c1a060f55822591745678a16334c18ece25e2bbf0a4e724eb8d16981688728792074613085099eae26a54482799266f57b15e6dfe0958
-
Filesize
797KB
MD58fb6b71f4d4ff373cfe0a081651d64cc
SHA15e5338ae381213b8e9f52c7440df362e06cdf4ee
SHA2564dc8fc1221fd5464ee1e4ed8f5725e423a19a514aa73a9d75c32e51140475d20
SHA5122851a8d20c6dd762547f9b272708dc040a4e230bcf7024dbba28ae461f51f2e46754e9ccfe9e45f0d15247846b18a905b6f4fae87e9a2381b920e4837d99f980
-
Filesize
1.1MB
MD52cf51545611bdbdccaa2e9bca6b3f150
SHA1e95dbbd50ea067294db1b2da0b8fd50eefcf1a94
SHA2567a4fa7e827cb271ea819d32e84d0627eff4264da9635f05b4f8b4e888cc00ea5
SHA512cf714394306014d69417d2bb4fa29d0fdd8acac40b47f9c0bb6c67cf7432c94ee80181afb2762fe8752cf40a7bdd2e5a5ab447355575a574e478d1d212ea1081
-
Filesize
1.5MB
MD5211479b7dff1a6c39ed9dc6f4347d1ab
SHA1672492dddcfea2428b33b24cd6214339f62d2f91
SHA256e62f96136ff3ec659e50d17cf20c7c74cbe23825a4ddf456fb9daddf609816ef
SHA5128e9f4f84a53055eec5e0ba20bf483e739da44ae11399152012a635177ec62aad63d4de5c7b74002414c411479272687226167a37d8ab4cfe07d92509bc70adb4
-
Filesize
1.2MB
MD5f9fc83cb4c480d1b66179f594eb30039
SHA1808c4747612bdbd0a6b7ce0d461906890f273859
SHA256ae4942ec8259d668eabe7a4ccf0e8d7f52304755e0724ca55506869784b66832
SHA512f7105601ef81e5bd752282e8cc928a2017281650c16f19d9ac5328fea55b19e02656d83126d609f114514dcf4efa89c44e5ba308cc4b3240d34ffc8a28019889
-
Filesize
582KB
MD5c507de8a1cab75642f5de3b130c1830d
SHA198cd8c9b3a8f06f1e1cf350c52f1a438c6bf8576
SHA256556f53760ba182b3922dfda5df632bf546dc6200ee32ffd121da48bceb510457
SHA512b9981108a47cde3d4ebe77e957bf9d349e79bff38b90f81d4861b4c08a24463c8cb96ff3d1bfa86d488c6eaf6edaeacb03ec364d10fd0c18a792d6c2a0e255da
-
Filesize
840KB
MD5de9179e5cf59f87280c23cf5037712cf
SHA187f23a765b116a34e231f46d179b3424158f1160
SHA2569f3e4e50ab78f3b171b88f593b92dc3f60cf840394d264252965c6f7f7a0a7d4
SHA512bd9875344bda5cffded9502a62d26b44a443a034f5cc7b940b0d191156c9248eeaef60cc09ab198493856b119afcea5ea2441e22775b120ca9da274d2edb0561
-
Filesize
4.6MB
MD50e9ffbd56f3b53221c72317606a8c45a
SHA1ed1bf360e51507ff03fe504afb2817fc607a56e5
SHA256625a2d8aac824212341cc6ccdaede541e0d9cfa49f39d2382f0e50dd8b8131c0
SHA512ede68c4c31f6809842d520bd73fabcbe055a4797f51929f90c050174a67743b7e8cca86a15f3c1f9d97d195ead9937bb07947a9be2fa58bce1e9292524e3ed75
-
Filesize
910KB
MD5caff6d48a560737579a0fe05edd6b7de
SHA16b954e2b4e4f4aa9b68dac1e053af6a7d8ecd6ca
SHA25652159a0414256d61f0000713b73371fad97c3a6abaf86c22cc4609cd1bb1a909
SHA512075f6990f29a2db112817716fcded365b883c3e22490b08a89f2766e6f9e8830743047349906fee2d6a84cf0af4bd3d90a9d32b321deb88bf8ca778f0e0d60ae
-
Filesize
24.0MB
MD54122f29a60cf876b48341db6647a482c
SHA18acdcdb1c6b102ad87dba3ae2d0f7c6ce2895b8d
SHA25646c98a47b32fc4d4b70f833efff76abb2a2e166d01345691e9a838e001df4375
SHA5120ee446ca37f51d033c8c0ab738ef1ac764b00c7fc57869a3182c768238286e92289f7a7434182045667cfb87678cc7c6e2171c4f373751b71aa8ac9a0d1d97d7
-
Filesize
2.7MB
MD5108979759931eaba8efa57564303e019
SHA1a0c4ec88473766f866f91bf347568f2f91d9f8a7
SHA256fd6016756060ab98cd2d6fda640a27deab3570a80cbd99787045e0670665b06c
SHA512b99841d7ab53df3a50e249e860c6a86f52ec9375dcdeec9e0d6134bacc2012d55e0c08fb895e7388ab4b23d659785847716a5b577de34e23b091b3460210705a
-
Filesize
1.1MB
MD5f1785def2e2a4e708ba9350d8c56bb4c
SHA1ddf40a0352d76964f9652d0adcd6e0db2519ccbe
SHA256831c17768e317aaecd0fc8c9b88ca5db2b9fcbd2fac34bc0b7281ec24fc12dda
SHA512f88e14d5f7cd7e0b887db68fea83126947306c78a5c943ad24ea8ab0137f7cf4f2a0cfa6a48739545e6a76297ac3928a5f503f5cde429681e33eb390dc6aa741
-
Filesize
805KB
MD5a94cac5fd444d1e0c26abbea07befbbe
SHA1d79f5ca45a95baa02f5d9f1958bd45350d54b146
SHA256a15aa52da99ec03ff5bcfeb7e9589aeecf77e831967b2625fe1ab6bd0386dc6a
SHA5128f1b25f77e03ef5a266cf15087858046917604f5d1c3251b5d074e8a102916d59522045623a2a5c888642e9d0eed6cf71a0a352b083b25443b9bc227a7525209
-
Filesize
656KB
MD53ff83d2ab3fa15352afc06e606d4a62d
SHA15ea29040193c75f795b98dc0d4287590a1d1d3b6
SHA256b3aa7119b46e450e3dc9d122da2d43d85fbdff65e1fbe7b8777a523313b076c2
SHA512a812d0221f53da8917fa129925c6bd7b2c52dbef3a5c7c3d331bd8548021d2be917b0562a8abb57701333b7ba0731cba2ee20de46d13a6cc3d50258a2bcef0b2
-
Filesize
5.4MB
MD5354a46e0d212e00190e09305be1f14e9
SHA1927198c2635276791f5d08927731d8be184e85fc
SHA256bac465a6f5532b9cba4e40a7dc79de8f62270d22de2f3c5c4378394f0caf3c4a
SHA5127acc041de880ead40807c8b849d879ae737d0b9d5c931b9ee8a4eff50b93fb08ff8bb205ee5ebbc47e7a6b47d26fcf4beb4b73b57bf5de3576fdae265b571a70
-
Filesize
5.4MB
MD5cbcd9fe4de35294adc00472ea9863318
SHA1a8f8e99f650f80e54fe699960170b1d7e21513d3
SHA256e699b91c76d033f8da8e5d75636f926de0253deaf59abd699604c91d89424ce2
SHA512900598550d48fe3b09ff5fd4ddb2364934a0523dbdf1165310529b856c9a66231bfe8744c8013a3cf1262dcd9eaa3c90510a44cc452d84c164450ab0e3de37a7
-
Filesize
2.0MB
MD5646676bdb7bbbe25931f71d8dddec4c6
SHA16046c4a5e094f6cb564762b101d33fa529167bb2
SHA256b781173a9ee3128c09b1a6814755eb9058ee271f40ed2bdf52a8396dbcc558f6
SHA512a7bd1a9851772cb04ce39af12af5e1ac6203bc479df6a34c67f0ba42ea0d59c505d7365a5ac6f1498d33d87b6680996a72e8c45d79789f8be1081a4c0cac9ade
-
Filesize
2.2MB
MD51c8add0551a2b3c22fff4e4970dca22d
SHA15f0acfe0426cbf58b57b5a71c611a2a85549b78a
SHA25620f66ae93bbb2acaf43e406e0eab6f4e088523c4bd6d1b3563bc507a3ed55a9f
SHA512b6b3f31eda82006ef408c501742c2b40d766f4c272f37af2131e630525ae3f069a8c16f2a05ecb2b21365037522b01910cc043ddb7716852c2c2bfb2d8d8d1f1
-
Filesize
1.8MB
MD5779f08b0f9a89ec36d733b1370301fe2
SHA148a2b0086b5dc54b9daf0b9d610ac65d46d00ab0
SHA2569ffa81af35be091e76b31893504092398f1196b3eeab69eebbf002368ba1e51d
SHA512ad75f0e19610ce07b5dc90befba7b63f6008c1e65615108446e71e89cfdc6295de201631f2f29a6c745e042ea8bdcbd314b0ba3667eb07ba62369e3c00d4aa33
-
Filesize
1.7MB
MD53049d9e75157dfdbdc5b4b4688f8a799
SHA1c7503134eb64a9d99bc5707e00ae2065ebe0940b
SHA256fc599e0027198e839363726664fb764418ed24eb14b8602e15e57f43f58bb658
SHA5120e4d873c810dfcd996a5e372ee18b9b561576270020a2308015631273204d688a02a2613d418642c9102624480d62362ba6405e121af69ddb8b6fe44c90c6865
-
Filesize
581KB
MD510f933fbb37f531091646d318b700cb0
SHA1b3e42f7f6624cc51bf2462e443a1e9f3417575fe
SHA25686822c74989802b58150a0ccb2e0d2feb32531b950e2f475d41bad033e033777
SHA512be2e3e8f7bf039b8a48f5857de598018b4e3029ff9a1cea8145e28ecc493872cf57d9a2aa0e66b9ee19902781d46a073a2fc4cd25b922b33a08adb9ed4573434
-
Filesize
581KB
MD58d03b5d84be24c73197f19e2d1ebefcb
SHA1674672225bdd50bb41e2f651af530fa54d9a7dda
SHA2561ad49fbcb35e42e0691488b7cea387d118e51f40c7ed1115e6d5d55ddb82c8f8
SHA5122c187425a4e0f1b0cbf2bd477ecccfdafe56edd15b81b57b23cd8c8ebab984a3bfc0e96347f03e97557b2081690354ab35b09f7af8f4dc7d4b2a50bc4610d72c
-
Filesize
581KB
MD5f1898f21317789b1ebd874bea88ec720
SHA11d6d8b0d43097e7e38b110c5c06b3d67e206bf34
SHA2567ad6d4e6490292a67387202a669b108d30fe536c0f3143202113df3a7ce4b8a6
SHA512c5995f8f58a68a7b8f5fd74f9f20525f4466f446f1f0f30b39d54de9df87e7afcb7804de514a3248ef91ba52eb1b39f99363d37187af71bfad11a2e2040b9df4
-
Filesize
601KB
MD5a2b7989d688ec37939e362fae069a27e
SHA1b879d7c712af0db4f6de3878c3591a861887110c
SHA256d81ef71a0f100b527b03b9b37d4bc0c52732afd26ce6ab3ef424c8ec6d1f67e4
SHA512bdf217d1ffb597be5b6d2ca5b47811ad32641a9138d39cb38468896870e015404c55da4736be1a6544483cc01c48d35f98db318894f77eea461c12a3686daf8e
-
Filesize
581KB
MD5faec2346b0f54723520b8b1e38430a28
SHA192d289c09825d33377ed6170c1ef5b58bc592265
SHA256ae7d7e635f54a3d49d4428dd633f958e8c3b91cba5db2860eccd8b355232233d
SHA51232e436538f69b9ce50499a09de544043f5b3b7638b623ed2e8b2c2f6356eacd0bdcfd509e1959ee9d01e05e90a747ebdd8ea5afe89f868a7bf27136343779166
-
Filesize
581KB
MD522b14bc2ee1d1d7c4907354bcef6409f
SHA14207edaee2db817f1f316dc82c4dab4597fbf3c1
SHA256e0c76b2a1b126cbdb3928774ac7fb9237b415d44dda5756cfb1cbdab8d1245b8
SHA51208d6d47f5b19feee0c055094b897976a8c53bf6d6fad1f9ad6272496489226265d2586cd3ebd4cef9f2add13b5ca02bbe61aa1aadd3d34c65ad9491eafe60ea4
-
Filesize
581KB
MD5f32c3fd7a9d8aae6a8da245c3fbe9691
SHA1ea34eb764369044eab12469abf5f75e72c8a93a4
SHA256fc01dd4131d782ebd748956a108535e14907224f9fb91919c421c4538ce4b7fa
SHA512d0bf58922b2937f3047f81697d343940cdc9be44306237f3ae01139b1f6e421d01f34c20d7be52563b364fd4e9ae0423dc2af056da92d79622f5883f73c116bb
-
Filesize
841KB
MD5a90591779af3720323146d3fcd328943
SHA14a9d02376cb9a417eac385ae44da194c0c8bae4e
SHA25652838fea22bbf692f505a08b73a8a42cb844f0e4a4aebe545b6cd0e8364bca9e
SHA512cf3d61b96f0e5a4b8842b910eac99c221cae10007244646fc09252f7909a35a877835ea0d15350b0cdc94c929b80c4afdcb66e4468630847bf4a20c110563dc4
-
Filesize
581KB
MD508b58c6329860c0be1c09701270f6fb4
SHA1ec9b930cbdad65e6585743235482843c2eb3dc45
SHA256a09a91fb422af2f75213d0c6f899c4e473474989bbeb6518bc756d18c141b91c
SHA512dead3f6e8841d5a266f20ccb94a440ce69c84919e07a8c31ca25efe973a8cc76e34bf6be5242fa1b97764e7a2fbaa4dc60528f3cd6a4cc778bbe606dfe5feb8c
-
Filesize
581KB
MD5effe925ccb42e2473c430f6e21022838
SHA19193746017dbef26c77483a11f22a9860806e1bd
SHA2565a615f0a2668e0e99a1e35a50535662b9f448fdde1d38de7ed21bcf7d4676125
SHA512109a1a7659db9343d2da0fcb482579e6f322a15e71eac0b67e6db53a740ed5c6b496f58369eb3a496c6645d71ce8440b895bebb1870db6092901b4f44a264452
-
Filesize
717KB
MD53829ccb60c872155cd4717e93fedffe0
SHA18bc857a64abc1435182c5aeb6883c8925a909455
SHA2560b0a2612be37e990a506af2225a391b5ac6ed27e8b4ec3909433b12d7c6a4455
SHA512237b7ddb5be35a8db640fde488c3ac8251e1dfb02acd13b93c6f85912d3e2f173a6811a41c3da11d8af423cd020f05307a21e55db35c863b854c305bbb11c7bb
-
Filesize
581KB
MD529fe3f62a3023efcd1eea494bfa51613
SHA1380fe8c6a193e21a871d800fe7e94da67c1a5d98
SHA256d65ab3f259fab4ed1de32b48a531fe7adf03e229b873b5de8a36260e10849e0d
SHA512bbe821b56c62907ddc1de69282573a3470a99ef428ff777da2a82c38aa45157d1086c1f17b53546035a26b3a295c7a55433314fc30501b3f173d5309b467a2c0
-
Filesize
581KB
MD5cd7ddeed83e1b4a91c8e5b0be937ac7d
SHA1b3e1cddd19485c0cf573c6ff4bb2ab78d6ef2979
SHA256b69a01be534851c2da9c9fc8aa0e401bce849d0f39e871c56f7cf475400538f6
SHA5123c03c23d5b65a8614065d6bc5242d2c51f4ab191cef74004964aa67d457fbeb998947f2f80fe5daf7f8b98a7f2945330b37fde3732f6cd3622cc53c57bd772f9
-
Filesize
717KB
MD5c76a48e14d1d4878504d5daed297ed12
SHA12fa262e5b6514a56056a84ead6f1c4ee1a10b437
SHA2561183e567e3410358d62617014d3d21f091307b2ad90a6937c83c76b73327d161
SHA512c1f2d79cf99cb90c279cbcceedb88144590f684f3bc7d5e5a3d38111bf75dc36b14f85dfa8deed637de9f50c785f36b67a9fd752a29317620d457af618fcdaf1
-
Filesize
841KB
MD58f894bdeb2d6e2ec91b0b2c505b9f503
SHA1d0ff87bd12865290e1aabe53a20ae4e6c130a2b1
SHA256d45e3c932d4fc36ade434995b90fa68287bfef05ae77e7e48c54383dc5b3a438
SHA512e7a2217d9a39fdf01559dee8075e063f422f44c3b3ce14af714930c68c9318aab04128bb822e0c654d4eb875d541b34a7c30b506126c7a3693621a951a887f16
-
Filesize
1020KB
MD5082cc6b42d79a61ca1828c528bc87158
SHA1a56c6a4d0331c871fdca6e212e37df5b9c41f497
SHA256696d7e90314e98a7997698f5b603b4a1518e98474211c4bef8afc8f2f59320b1
SHA512040ba50b3c424ed67a44937403af97a036775e7bd8a84140e5c86b08092d0e971600033fda285390c306a7e3d2d1e572d9445144c47530ad906d8cfbe1e9c6ca
-
Filesize
581KB
MD512f6dd48fede34af0f82348ac780434e
SHA1b29a8cc32a7db39c716082e19fd36165ad48a60f
SHA2565109617d479f194e5b68975854a2f571c2bc52856d38d257eac1644ddef4a7b6
SHA512ccb2fdd7d38d1d72a9e728db81ab5a4162c47e73dcf16e7a77cdfada5da3d56ba9e07549aa7e87e517848ad2d6881f3e722fc8a4c4adfd2a9347a8c2193a1ff3
-
Filesize
581KB
MD5c3f4a0aa2b912ebf09a42b0bfa1967a2
SHA121cf39141380d8c2924e7eaac8de0535631d85bc
SHA256ead0520c1e07a57e3ff315ce3ef2eb3ae4e16921230890fbfca7620c83142faf
SHA5123bd5d3c3e71a4dbb5568ef2f5717222d21c5d1bc8f2d6080670eb681b822992ceb148af647c96e6ac48f0fabc2408b4d73793c23d49ad74cc72a4538c219adad
-
Filesize
581KB
MD5855359c7fb350875e7fda4864aa7831f
SHA10316719162dc43779e2253bb06a98253c25a9e36
SHA256002613f0977903e42774cc1b7c217c6bb66b07666df385a5a623b041c606de58
SHA512c528ec3c3af415ff1f668b9fbc62ed0a66d6b00e95cafb5afb7b38ba0fb6a499019c5becf24873df31943eb355c33dba76df9054e52885279d328cca914ff627
-
Filesize
581KB
MD519df49418ed78321dfbeccb98c6a4ecb
SHA1d7699437034aae3f5fb1cddb11429f043a180efb
SHA256e34bbbe60d25919dfb542d883e9be655591a0a359294115e22db076d153caff0
SHA512534373015034ca12ce39e06926e664392c212d852b830e79af78071cb88af732d02607915c6022cb7aa7bb1198af4f2840c431ef9f9107e8bc81aaae5cd87246
-
Filesize
581KB
MD5979a9fcd9d88545cf85a31aca12629b2
SHA1325c777e79b30ea9ae939063daf6cacb46cc1f05
SHA256f2f5fa7b63abf9dabadec30fdc675039a75ad5d620d7179bce3c70541cd4a7d8
SHA512101920e1e136fd1b14914e9ad6f0d015cd0dd7716c477e6fe66eb64433df1381ad24f58771dadab8a2cb196f493fe83a169a012690e50641de0ce99d0828c4fd
-
Filesize
581KB
MD5853584786d9b6841459dfb1e0e896f7a
SHA1e64c4e3749ca2891b260c9b793396343c6a1ccea
SHA25637f3ef242469031a4c0bb617c479ecf130f15ac21bfbe07316aa3b150beba516
SHA512b84d0b1a3c605652940c3e30ddfa04bb9fb9ea8d7115e418dc524bca67149084bfd3be0e772f6f0cf30bc445fc1ad7c62eb66c6568131c126fc5c170aa4bcd01
-
Filesize
581KB
MD5d9c6e163784993d217abbda5313830e5
SHA1f9e613c78393e0cd6440279f89c4bca7aa6afc19
SHA2563a4f68cfe33d43d37db411ac4cb959343b90ec2ea944009d398e1fbbc806342c
SHA512b8524d2a81dfd97dbae7de802860e0bd2eeb852e03c726abbc8c7b89a558214137cec6f49d2fc5fbf7cead0f97c979189c298ac3328a2f95a375a71f08c0ea99
-
Filesize
581KB
MD53053d0ec4e3aeedeec278df8971029d8
SHA1cc4061c97c5245069a6ea476e4588017897ba51d
SHA256ad765a54bd86e852a8a35f3a549952faa30f86a0479cc4279cd400f8fd2ac9b5
SHA512987f95edd49516a969513230be69315b1b2547ec5a8fc4064ebbd82cfc0976621ce381807983067506f1d2bc8679a2a2b70a8eb4901341cee807aa4b97bdfb30
-
Filesize
581KB
MD54ed3230f9ec50b5781c8a98be9820ec3
SHA128716c6e92599fc4ac52092d374ff180c5490d33
SHA25671d2746af8548af1a5c8805df0c3e3fd5654a10552f6c74b9730f5a59d013828
SHA51285d040ac3cbbf6600e093f404972fed7589140ac11edf7f3573f93fe75e8f492e97970ff7614affca8c52959b3d14c93ba60c49996de9267c0b411b5815075d1
-
Filesize
581KB
MD57b11033dbde92b2e3f6c5f2d4abe7808
SHA18ab543c16b2abaeef8d7506b8e285797caaab676
SHA256a27e8d4b9a1ca38264bf045712085359465f4624ab23926c64dadeab6443d940
SHA51210f831a8e2e7f51e061ee6eb0bf0f18463e62948785554260f38fa296823884f98d6b2a43b9f1311c28e4634ea837823362324316b1a6738221d61897a1bcf86
-
Filesize
581KB
MD508cebe51a2f96435d6abb90918fc2324
SHA1a1b11bc7957ed8d7fa58d75666ead51381c09a5a
SHA2561437eb24b3af5d866f0abc10e3092c1f949829d8b6996c0d63fc74dd9b5614a6
SHA512f3f6a3eae37096ac0541c049c5357bc80fcc5e9a357d71ff0ae6d3563cf3baf531617e0fd16e2c0728fc6d37a993a9ce74afd86330ec224ebe40ae9523bf6d8f
-
Filesize
581KB
MD51548e17388ec689421613b58e8004eb5
SHA17aa14c87c98aacd903bc515d1a24914ee7c091e9
SHA256d5f2f06331b6a0e006aed18758c3e6b6a133c358a43a7b3a63f35f28faa0f691
SHA512f3ac140db19baca744bfa96cc8e72f77ffb60842144a282bc2d9712beae19ffb4099cf70cb53e92c59914fbb256c9fa4bc79f3abd138e521482741b6a706bee1
-
Filesize
581KB
MD56f557d00045104ebbece0e953aff8550
SHA18c701918ca703dec2084748a4144f802a9bc88d8
SHA2562b307da7483dd26f2ab2db439adf3bff1e348defe80ee492d1214bc1ec85b125
SHA5125e0f4c66805efd38f8de991e6ba31102c5e17ae9730e103e033821fdf3216ebe17aaf29d84fb6e75f6ef6a9d927d19302e53603af8cc69339806975b1415f11f
-
Filesize
581KB
MD552c8acd4c1e95620e8987ec2ba109ffb
SHA16b50a194b959efbea4a451cf7c433abed8c0e704
SHA2564cb18f7ffa80cc3b66808fdcfb9bef047ae7468ddc6201683ed9447ea87141d0
SHA512c29ef8f52191bf7ae648c6e2c7e9bc768642e0c5449cdb2975074427b8641b9e9ef250fd058151a65ccaf7b633e3587e70bb75cf48969dc0c6c6fea6fe4a463d
-
Filesize
581KB
MD56d48ecc0ee212d9ba3bbde5961f9c3cb
SHA1d68ab8f0b0157dc5744392ce80f629afe6bcbff2
SHA256be722c5aa0afd0d8ff6a9f2fe3dca67caf0f4cc60f126bea92f3c02ad71da000
SHA512a3b96535fab0572c07af43af469624a702c2a3cf7f1083e59ceaaae834ed9b45b4f7234ac25f44350347cd1d49fdf43e62aad1c8036e7747f3691aa5fdc7d580
-
Filesize
581KB
MD54f0e5d280ba9eedccfa390d9fa976396
SHA1d9e4d2bf85db56b6991053cc35739f77a7b139df
SHA2563aec8cf60b0f244e140a60cc1dbb02c6dbf3ef4850aed1f0a940cd32f36657b1
SHA512aca5594aadf38fbe54ccccbabe302b25199aca65715b4257dad68580d978298bd6a211278199cb6c1bca2572e18a2275d94b5c1081289c17d98cc3687dbf42e9
-
Filesize
581KB
MD5a3c7cd6a29f31c07afb819d1c0604326
SHA10957341df16181ece96db9df7a19feb86e5c9a0d
SHA256efea2c7b9a940f4bff394130baffdc2f62e596274ff23f165e45fee9b6e4281b
SHA512df53e73d9f7de6208b3d4146caf5583e88e3aaffd4c81d2c340000aa6033f74f040ec9532d8a27720d9145709abcd39e98e7cb69218efe613d3d736ae8981851
-
Filesize
581KB
MD5c2b2b017ced355cfaece3f792761bc06
SHA194856e4a83bb3c2c4158a42b08f4184fdd2bc0d8
SHA256331cf0bdbd964d5f0aaef27eeeb73e80e6b5ad438d22c3bee1c81d3fcc81491a
SHA51283108b683a17f839159246f279a4b790614c5292c11adaae430b7b9cfe47616bc665bf5f6feab54fa01c4b922bb898ef6ae38feb8a4118de77ed779dad3689cf
-
Filesize
581KB
MD592cbfe7687c0ef2f340b1cd261dc60c9
SHA1af8b4140d8ffdf197dd933320c3a8b0f2dfe1e8f
SHA256b999aa6d823fe22ff18e0ece20c0d59a3c1f68657523000098b77cd1dc41b72a
SHA51227370aa12ede3244585bb1674da1c147e78427be34b9b2e4e08c1e261e630b99d189ffeaabb29fe45347c9346b69125f3a426a3cde6c28ab4b029fa2c6ac4db8
-
Filesize
581KB
MD5bda500fb904f1222583dbe5f5cc87c63
SHA164101aca59337c13c745e7f35c032ee83ea26985
SHA2560696cef38049775a71bb5c00d4687e8533a71ea286920909f17f2a74949dfd60
SHA5121db3a92475535656f0177d9533ee95e27ed2e48fd07964de36de3df7df12805bebe7a1b63ab6b05e1d1a14ceca23451eda6ddbd835bd9fbd8107c0c89079f0fc
-
Filesize
581KB
MD5705dd7d4c91eabf9d9b9baec58e11c80
SHA103603efa415a96d0a872c1bdc0d849c4b8a163ae
SHA2566f78f67eeb24cf78140aac43359f7fdbacf2c0e3e55691a5bc36808087b61099
SHA512c20059c7dbdfb0e80b62189c4e13b772970e0e30262ae2b0515a618314415fce20f82108d495151e95567721b402a0030668eac71e496d2a697c8f7677ace3ff
-
Filesize
701KB
MD59a7f43aaf0a350a850e7de79d96347af
SHA1738f104738fd9d05bb8ec95871ca90a9a7a12197
SHA2560cae746b4640bb1f901d3aa2b76983c562199f149dafb8a2ce4673314a4c740e
SHA512105478706168072f431c347ff01b7c95752bc73fc061b51c9bdcec855a578012f45b6f101f32938925b9943ebc07879ec110a1ab225587e8cc42525c687579fc
-
Filesize
659KB
MD5c5c9a78451b3cc69f5a5337f17d64399
SHA13c3a913d0d0e120675b851a80e490968793739d7
SHA2563b4228323d44af132baac4f0fa14d6a67dd993a1c8d98514cb20da5b9a19e6f4
SHA512b02f78143872110acb0a5fe91436f66fc1b3707a12c6cc1c3ecc56e83053268472d3194278395e6b32c194f7661a072eae9af458bbf750a1768ec79d0bc6a2f2
-
Filesize
661KB
MD5c4c7fbcf83cff3ce6dbf0aa30ab419b4
SHA12b586f16e8b09e68ddff23be1804887a18b35d7c
SHA256a3ded77b5aca8a85c1275ce024f78e8354ae4f9a115976a94da5c62a3a2fdc5c
SHA5127a28b202a9c8df9a3bc46dcebab3ef4f89f0dcd47b11336431f718ba1d0268d815065301ce0854f3cc284546de28ee70d5560c0811394938a3f4eacfec035720
-
Filesize
1.3MB
MD571be171e35f5237fa2f70c80e5926e01
SHA1cd0ce859afaa3f45f4a9bcaa789ccc0d30f28479
SHA256822f8d8a8c3aba73c457e298c885b94e0bcc369e00d62046d30baca6f15c2abb
SHA512f16dec33f7d8e4a667e6039f9d3bed3631c42aee7564193b3832a9e02d0140df4f1edfd59c631e95f9a5c8497b0178b77fc0436fd65bb415ecdc1e78dd793a9a
-
Filesize
1.2MB
MD539dc4b7e82dca9b93b5883aabb519e5b
SHA1b7dd28c55e69dba35d515381d9804f8aecc0ae5a
SHA256ebfb079e0b5f6bc823f30b8e94309f8c21ff78a10964362b364a8d207c32d4ba
SHA512751128e826b71c842414a4927845fb9243d4976f0233fcb93d8313da59657d139580b5204bb9bbd9cc47283ffdf0d473c944ea78cd75a4e40832241c462023b7